Certification failure on auto update to 2020.1.1

Hi,

the auto-update feature isn't working for me. I'll get the following error when trying to auto update from 2020.1 (build 78475) to 2020.1.1 (build 78657) (using debug mode):

[2020-06-29 16:02:04,671] DEBUG - jetbrains.buildServer.UPDATE - TeamCity versions update check result: 1 new versions found (6 total)
[2020-06-29 16:02:04,672] DEBUG - jetbrains.buildServer.UPDATE - New versions of TeamCity are available: [Version[2020.1.1 build(78657, 2020-05-18), status: release, name: 2020.1 Release, id: 2020.1]]
[2020-06-29 16:02:04,674] INFO - jetbrains.buildServer.UPDATE - New TeamCity version is available: 2020.1.1 (build 78657). Auto update is possible
[2020-06-29 16:02:06,389] INFO - jetbrains.buildServer.UPDATE - Start downloading TeamCity 2020.1.1 (build 78657) distribution, requested by POST '/admin/update.html?prepare=1&version=2020.1.1', from client ***, authenticated as *** {id=1}
[2020-06-29 16:02:06,392] INFO - jetbrains.buildServer.UPDATE - Downloading TeamCity 2020.1.1 (build 78657) distribution from https://download.jetbrains.com/teamcity/TeamCity-2020.1.1.tar.gz to C:\TeamCity\updates\78657\TeamCity-2020.1.1.tar.gz
[2020-06-29 16:02:06,424] WARN - jetbrains.buildServer.UPDATE - Error while preparing for 2020.1.1 (build 78657) update (failed to download TeamCity distribution): java.io.IOException: Failed to download TeamCity update by GET https://download.jetbrains.com/teamcity/TeamCity-2020.1.1.tar.gz
[2020-06-29 16:02:06,427] DEBUG - jetbrains.buildServer.UPDATE - Error while preparing for 2020.1.1 (build 78657) update (failed to download TeamCity distribution)
java.io.IOException: Failed to download TeamCity update by GET https://download.jetbrains.com/teamcity/TeamCity-2020.1.1.tar.gz
at jetbrains.buildServer.updates.HttpClientDownloaderImpl.lambda$download$1(HttpClientDownloaderImpl.java:14)
at jetbrains.buildServer.util.HTTPRequestBuilder$ApacheClient43RequestHandler.doRequest(HTTPRequestBuilder.java:147)
at jetbrains.buildServer.util.HTTPRequestBuilder$DelegatingRequestHandler.doRequest(HTTPRequestBuilder.java:8)
at jetbrains.buildServer.updates.HttpClientDownloaderImpl.download(HttpClientDownloaderImpl.java:21)
at jetbrains.buildServer.updates.UpdateOptionImpl.lambda$null$2(UpdateOptionImpl.java:145)
at jetbrains.buildServer.serverSide.impl.BaseAccessChecker.runWithDisabledChecks(BaseAccessChecker.java:30)
at jetbrains.buildServer.serverSide.impl.SecondaryNodeSecurityManager.executeSafe(SecondaryNodeSecurityManager.java:20)
at jetbrains.buildServer.serverSide.IOGuardInitializer$IOGuardDelegateImpl.allowNetworkCall(IOGuardInitializer.java:12)
at jetbrains.buildServer.serverSide.IOGuard.allowNetworkCall(IOGuard.java:69)
at jetbrains.buildServer.updates.UpdateOptionImpl.lambda$prepare$3(UpdateOptionImpl.java:115)
at java.base/java.util.concurrent.CompletableFuture$AsyncRun.run(CompletableFuture.java:1736)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
at java.base/java.lang.Thread.run(Thread.java:834)
Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:326)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:269)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:264)
at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:645)
at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:464)
at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:360)
at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:392)
at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:444)
at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:422)
at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:183)
at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:164)
at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1144)
at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1055)
at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:395)
at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:290)
at org.apache.http.impl.conn.HttpClientConnectionOperator.upgrade(HttpClientConnectionOperator.java:175)
at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.upgrade(PoolingHttpClientConnectionManager.java:334)
at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:398)
at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:219)
at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:195)
at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:86)
at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:108)
at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:184)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82)
at jetbrains.buildServer.util.HTTPRequestBuilder$ApacheClient43RequestHandler.doRequest(HTTPRequestBuilder.java:63)
... 12 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439)
at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:306)
at java.base/sun.security.validator.Validator.validate(Validator.java:264)
at java.base/sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:313)
at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:222)
at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:129)
at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:629)
... 33 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)
at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:434)
... 39 more

Teamcity is running on a Windows server which uses a proxy to reach the internet.
The proxy settings (using internal properties teamcity.http.proxyHost/Port and teamcity.https.proxyHost/Port) do actually work as the update check succeeds.

Just to make sure I've also added

-Dhttp.proxyHost=proxy -Dhttp.proxyPort=8080 -Dhttps.proxyHost=proxy -Dhttps.proxyPort=8080

to my TEAMCITY_SERVER_OPTS enviroment variables (I can see that the config is loaded correctly in the diagnostics view).


Am I missing something to make the auto update work using a proxy?

Btw: A manual download using a webbrowser on that server does work.

Any help would be much appreciated.

Kind Regards

Orange